Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Npcap 1.71: Hardware packet filter may be ignored (e.g. promiscuous unset) when adapters are listed after capture starts. #647

Closed
dmiller-nmap opened this issue Nov 15, 2022 · 1 comment
Labels

Comments

@dmiller-nmap
Copy link
Contributor

Introduced in 28b7307. Fixed in f7837ff.

While traversing the list of open instances (capture handles) to remove one and accumulate the packet filter values of the others, the Next pointer of the instance being removed was set to NULL, causing early termination of the loop. Any instances farther down the list (i.e. older instances) would have their packet filters ignored, resulting in incorrect capture parameters being used. This removal happens on every adapter during a call to pcap_findalldevs(), so it is reasonable to assume it will affect a significant number of users.

The next time any instance sets a packet filter, a different, unaffected loop will accumulate the previously ignored values, resolving the issue. Therefore in most cases where listing adapters is immediately followed by starting a capture, the interruption will be of short duration.

This issue affects Npcap 1.70 and 1.71.

@dmiller-nmap
Copy link
Contributor Author

This is resolved in Npcap 1.72.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

1 participant